* [PATCH] rust: num: seal Integer
@ 2026-09-05 2:17 ` Younes Akhouayri
0 siblings, 0 replies; 5+ messages in thread
From: Younes Akhouayri @ 2026-09-05 2:17 UTC (permalink / raw)
To: Alexandre Courbot, Yury Norov, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg, Alice Ryhl,
Trevor Gross, Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Onur Özkan
Cc: rust-for-linux, linux-kernel, stable, Younes Akhouayri
Bounded relies on Integer implementations to describe primitive integer
semantics correctly. In particular, it uses Integer::BITS and Signedness
to justify unchecked operations.
Integer is currently safe and externally implementable, so an
implementation can violate those assumptions and make safe Bounded
operations reach undefined behavior.
Seal Integer so only the primitive implementations provided by the
kernel crate can satisfy it.
Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/
Cc: stable@vger.kernel.org
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Younes Akhouayri <git@younes.io>
---
rust/kernel/num.rs | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/rust/kernel/num.rs b/rust/kernel/num.rs
index dbe848e30efe..de589792a77a 100644
--- a/rust/kernel/num.rs
+++ b/rust/kernel/num.rs
@@ -15,9 +15,14 @@ pub enum Unsigned {}
/// Designates signed primitive types.
pub enum Signed {}
+mod private {
+ pub trait Sealed {}
+}
+
/// Describes core properties of integer types.
pub trait Integer:
- Sized
+ private::Sealed
+ + Sized
+ Copy
+ Clone
+ PartialEq
@@ -56,6 +61,8 @@ pub trait Integer:
macro_rules! impl_integer {
($($type:ty: $signedness:ty), *) => {
$(
+ impl private::Sealed for $type {}
+
impl Integer for $type {
type Signedness = $signedness;
---
base-commit: e510334fbaeaa016ac76d80b4c5f47611c5f7860
change-id: 20260903-feature-rust-num-seal-integer-a4262df429c6
Best regards,
--
Younes Akhouayri <git@younes.io>
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] rust: num: seal Integer
2026-09-05 2:17 ` Younes Akhouayri
(?)
@ 2026-09-05 14:12 ` Miguel Ojeda
-1 siblings, 0 replies; 5+ messages in thread
From: Miguel Ojeda @ 2026-09-05 14:12 UTC (permalink / raw)
To: git
Cc: Alexandre Courbot, Yury Norov, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg, Alice Ryhl,
Trevor Gross, Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Onur Özkan, rust-for-linux, linux-kernel, stable
On Sat, Sep 5, 2026 at 4:17 AM Younes Akhouayri via B4 Relay
<devnull+git.younes.io@kernel.org> wrote:
>
> Integer is currently safe and externally implementable, so an
> implementation can violate those assumptions and make safe Bounded
> operations reach undefined behavior.
Ideally, we would give a brief indication of how that can happen (like
saying "e.g. by writing ...") or sometimes even with an example if it
is short enough :)
> Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
> Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/
Reported-by: usually precedes the Closes tag, e.g.
Reported-by: Miguel Ojeda <ojeda@kernel.org>
Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/
(But it is fine, i.e. no need to send a new version just for that)
Thanks for doing this! If Alexandre is happy with it, I will take it.
Cheers,
Miguel
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] rust: num: seal Integer
2026-09-05 2:17 ` Younes Akhouayri
(?)
(?)
@ 2026-09-05 14:22 ` Gary Guo
2026-09-06 0:17 ` Alexandre Courbot
-1 siblings, 1 reply; 5+ messages in thread
From: Gary Guo @ 2026-09-05 14:22 UTC (permalink / raw)
To: git, Alexandre Courbot, Yury Norov, Miguel Ojeda, Boqun Feng,
Gary Guo, Björn Roy Baron, Benno Lossin, Andreas Hindborg,
Alice Ryhl, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Onur Özkan
Cc: rust-for-linux, linux-kernel, stable
On Sat Sep 5, 2026 at 3:17 AM BST, Younes Akhouayri via B4 Relay wrote:
> From: Younes Akhouayri <git@younes.io>
>
> Bounded relies on Integer implementations to describe primitive integer
> semantics correctly. In particular, it uses Integer::BITS and Signedness
> to justify unchecked operations.
>
> Integer is currently safe and externally implementable, so an
> implementation can violate those assumptions and make safe Bounded
> operations reach undefined behavior.
>
> Seal Integer so only the primitive implementations provided by the
> kernel crate can satisfy it.
>
> Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
> Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/
> Cc: stable@vger.kernel.org
> Suggested-by: Miguel Ojeda <ojeda@kernel.org>
> Signed-off-by: Younes Akhouayri <git@younes.io>
> ---
> rust/kernel/num.rs | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/rust/kernel/num.rs b/rust/kernel/num.rs
> index dbe848e30efe..de589792a77a 100644
> --- a/rust/kernel/num.rs
> +++ b/rust/kernel/num.rs
> @@ -15,9 +15,14 @@ pub enum Unsigned {}
> /// Designates signed primitive types.
> pub enum Signed {}
>
> +mod private {
> + pub trait Sealed {}
> +}
I feel that it's time to add an attribute macro for sealing.
Yes, more macros :)
Best,
Gary
> +
> /// Describes core properties of integer types.
> pub trait Integer:
> - Sized
> + private::Sealed
> + + Sized
> + Copy
> + Clone
> + PartialEq
> @@ -56,6 +61,8 @@ pub trait Integer:
> macro_rules! impl_integer {
> ($($type:ty: $signedness:ty), *) => {
> $(
> + impl private::Sealed for $type {}
> +
> impl Integer for $type {
> type Signedness = $signedness;
>
>
> ---
> base-commit: e510334fbaeaa016ac76d80b4c5f47611c5f7860
> change-id: 20260903-feature-rust-num-seal-integer-a4262df429c6
>
> Best regards,
> --
> Younes Akhouayri <git@younes.io>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] rust: num: seal Integer
2026-09-05 14:22 ` Gary Guo
@ 2026-09-06 0:17 ` Alexandre Courbot
0 siblings, 0 replies; 5+ messages in thread
From: Alexandre Courbot @ 2026-09-06 0:17 UTC (permalink / raw)
To: Gary Guo
Cc: git, Yury Norov, Miguel Ojeda, Boqun Feng, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Onur Özkan, rust-for-linux, linux-kernel, stable
On Sat Sep 5, 2026 at 11:22 PM JST, Gary Guo wrote:
> On Sat Sep 5, 2026 at 3:17 AM BST, Younes Akhouayri via B4 Relay wrote:
>> From: Younes Akhouayri <git@younes.io>
>>
>> Bounded relies on Integer implementations to describe primitive integer
>> semantics correctly. In particular, it uses Integer::BITS and Signedness
>> to justify unchecked operations.
>>
>> Integer is currently safe and externally implementable, so an
>> implementation can violate those assumptions and make safe Bounded
>> operations reach undefined behavior.
>>
>> Seal Integer so only the primitive implementations provided by the
>> kernel crate can satisfy it.
>>
>> Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
>> Closes: https://lore.kernel.org/rust-for-linux/CANiq72mOfR33s4y+Ueivd5NrC5yre+Pcp57ZOBz0msw9A4AP1Q@mail.gmail.com/
>> Cc: stable@vger.kernel.org
>> Suggested-by: Miguel Ojeda <ojeda@kernel.org>
>> Signed-off-by: Younes Akhouayri <git@younes.io>
>> ---
>> rust/kernel/num.rs | 9 ++++++++-
>> 1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/rust/kernel/num.rs b/rust/kernel/num.rs
>> index dbe848e30efe..de589792a77a 100644
>> --- a/rust/kernel/num.rs
>> +++ b/rust/kernel/num.rs
>> @@ -15,9 +15,14 @@ pub enum Unsigned {}
>> /// Designates signed primitive types.
>> pub enum Signed {}
>>
>> +mod private {
>> + pub trait Sealed {}
>> +}
>
> I feel that it's time to add an attribute macro for sealing.
+1, this is going to be a really common pattern.
^ permalink raw reply [flat|nested] 5+ messages in thread